Autonomous AI Agents Break Into Websites With Almost No Human Help
A Chinese-speaking criminal pointed autonomous AI agents at company websites and let them break in with minimal guidance. Researcher Snorre Fagerland of NorForge observed the activity because the operators left their control panels open on the internet. Reuters reviewed the attacker's records.
How It Worked
NorForge found the operations by scanning for exposed copies of Cairn, an open-source AI tool meant for authorized penetration testing. Cairn gives agents a starting goal and lets them proceed step by step, posting findings to a shared board where the operator can add hints. The operator's instructions were reportedly under 100 Chinese characters.
A typical task was to gain code execution on an online shop and plant a web shell uploader. One documented chain combined unauthorized write access to a memcached session store, unsafe handling of saved PHP objects, and a weakness in old Zend Framework code. Paths varied by victim. Cairn's author told Reuters the tool was not designed for attacks.
Scale and Results
- About two dozen malicious Cairn instances in three clusters
- The largest cluster, AIA0001, linked 14 panels to more than 1,100 attack projects, with targets in the US, Japan and Australia
- Agents tried more than 1,200 sites and reached more than 100 companies, including Deere, SharkNinja and Cummins
- Successful break-ins averaged just under 23 hours, with an overall success rate near 10%
- Estimated cost: roughly $5,000 in tokens, or about $50 per successful hack
- 11% of secrets found in panel data were still valid when verified
Tasks ran under a worker named "claudecode_deepseek-v4.1-flash," suggesting a DeepSeek model driven by Claude Code, though neither NorForge nor Reuters confirmed the models.
Victim Responses
- Deere said it fixed the problem and saw no sign sensitive information was accessed
- SharkNinja said a standalone product-support site was hit and contained
- Cummins said it was investigating a possible attack on a vendor's website
- NorForge also confirmed a compromise at a very large US retailer and a live web shell at a large hardware-parts vendor
Defensive Guidance
- Hunt for exposed agent panels, which often listen on port 8000 without a login.
- Look for stray upload forms in hidden directories; they were the foothold these agents sought.
- Patch Magento: apply Adobe's hotfix for CVE-2026-75650 (StyleSmuggler) on Adobe Commerce 2.4.4–2.4.9 or Magento Open Source 2.4.6–2.4.9. There is no evidence it was used here.
- Lock down session stores such as memcached and avoid unserializing untrusted PHP objects.
NorForge is asking hosting firms to remove the panels and is notifying victims. A separate September report from Gambit Security described a different criminal using Cairn to steal credit cards; no source links the two.
Sources: The Hacker News, Reuters.